On 26 March 2026 the UK became the first country to sanction Xinbi, a Chinese-language "guarantee" marketplace that grew up on Telegram and, by blockchain analysts' estimates, has moved more than $24 billion. Xinbi sells stolen personal data, fake IDs and satellite internet gear to the scam compounds of Southeast Asia, and launders their crypto. In September the US followed. For developers the link is direct: breached customer databases are part of what is sold there.
What happened
The UK Foreign, Commonwealth & Development Office and Home Office announced a package of sanctions aimed at the scam-centre industry:
- Xinbi, described as one of Southeast Asia's largest crypto-based marketplaces serving scam centres. The UK says it sold stolen personal data used to target victims, supplied satellite internet equipment used to contact them, and helped launder crypto stolen by North Korea.
- Legend Innovation Co., operator of the #8 Park compound in Cambodia, which the UK links to the Prince Group and says can hold up to 20,000 trafficked workers, along with its director Eang Soklim.
- Thet Li and Hu Xiaowei, associates of Prince Group chairman Chen Zhi who managed parts of its financial network.
Blockchain-analytics firm TRM Labs estimates Xinbi has handled $24.2 billion since 2022. It runs as a Telegram-based escrow service. Telegram banned large Xinbi channel clusters in May 2025, and Xinbi pushed users to its own messenger, SafeW, and a no-KYC wallet, XinbiPay/NewPay, that supports USDT on several chains.
On 9 September 2026 the US Treasury designated Xinbi Guarantee as a transnational criminal organisation, sanctioned Anwen Technology (developer of XinbiPay) and SafeW Technology, and the Justice Department's Scam Center Strike Force seized Xinbi infrastructure and wallets. Treasury put Xinbi's volume at more than $24 billion.
Who is affected
- Victims of "pig-butchering" and other investment and romance scams run from compounds like #8 Park, and the trafficked workers forced to run them.
- Exchanges, payment processors and fintechs with UK or US exposure, which now have to screen for Xinbi, SafeW and XinbiPay-linked wallets and counterparties.
- Companies whose customer data has been breached, since stolen personal data is one of the goods traded on such markets.
What it means for developers and engineering teams
Most teams won't touch Xinbi directly, so this section is short. Two points matter. First, if you build payments, wallets or crypto on-ramps, sanctions designations become compliance requirements. Your screening lists and on-chain monitoring need updating, and "we didn't know" is not a defence once a name is on the list. Second, these markets turn leaked PII into scam targeting. Names, phone numbers and investment interests from a breached CRM help a scammer make first contact. Data minimisation and breach prevention reduce real-world harm, not just regulatory risk.
The move from Telegram to self-run apps after the 2025 ban also shows a pattern: when platforms remove criminal infrastructure, operators move to infrastructure they control, which is harder to disrupt without seizures like the one the US carried out.
What to do now
- Payments and crypto teams: make sure sanctions screening pulls the latest UK and OFAC lists automatically, and that blockchain analytics flags Xinbi-linked addresses.
- Everyone holding customer PII: collect less, encrypt sensitive fields, limit bulk-export permissions and alert on large exports from CRMs and support tools.
- Customer-facing products: warn users about investment and romance scams in onboarding or transaction flows, especially for crypto transfers to new addresses.
Sources
- GOV.UK: UK crackdown on scam centres steps up with sanctions on illicit crypto network (26 March 2026)
- US Treasury: sanctions on Xinbi Guarantee and related entities (9 September 2026)
- TRM Labs: UK becomes first country to sanction Xinbi
- Infosecurity Magazine: UK cracks down on Chinese crypto marketplace